cs.CVApr 3, 2026
SaveDocShield: Towards AI Document Safety via Evidence-Grounded Agentic Reasoning
Organizations: Ant Group · Nanyang Technological University · CFAR and IHPC, Agency for Science, Technology and Research (A*STAR), Singapore
Abstract
The rapid progress of generative AI has enabled increasingly realistic text-centric image forgeries, posing major challenges to document safety. Existing forensic methods mainly rely on visual cues and lack evidence-based reasoning to reveal subtle text manipulations. Detection, localization, and explanation are often treated as isolated tasks, limiting reliability and interpretability. To tackle these challenges, we propose DocShield, the first unified framework formulating text-centric forgery analysis as a visual-logical co-reasoning problem. At its core, a novel Cross-Cues-aware Chain of Thought (CCT) mechanism enables implicit agentic reasoning, iteratively cross-validating visual anomalies with textual semantics to produce consistent, evidence-grounded forensic analysis. We further introduce a Weighted Multi-Task Reward for GRPO-based optimization, aligning reasoning structure, spatial evidence, and authenticity prediction. Complementing the framework, we construct RealText-V1, a multilingual dataset of document-like text images with pixel-level manipulation masks and expert-level textual explanations. Extensive experiments show DocShield significantly outperforms existing methods, improving macro-average F1 by 41.4% over specialized frameworks and 23.4% over GPT-4o on T-IC13, with consistent gains on the challenging T-SROIE benchmark. Our dataset, model, and code will be publicly released.
Figures & tables
Figure 1. Performance comparison on the RealText-V1 benchmark. DocShield (pink area) achieves state-of-the-art results across Detection (D), Grounding (G), and Explanation (E) tasks. M-F1 (macro-average F1 over the three tasks) serves as the unified evaluation metric, demonstrating DocShield’s superior and balanced multi-task capability. A radar chart comparing DocShield (pink area) against multiple MLLM baselines on RealText benchmark, showing metrics for detection, grounding, and explanation tasks, with DocShield demonstrating superior performance across all dimensions.
Figure 2. Overview of the DocShield framework. Given an input image and a prompt, the model autoregressively generates a structured, machine-readable Report . The analytical core is the Cross-Cues-aware Chain of Thought (CCT) , a six-stage mechanism that iteratively extracts and cross-validates visual and logical anomalies. To ensure forensic faithfulness, the framework is optimized via Group Relative Policy Optimization (GRPO) using a Weighted Multi-Task Reward , strictly aligning spatial evidence, format compliance, and explanation fidelity. Diagram of the DocShield framework showing image input and prompt processed through the Cross-Cues-aware Chain of Thought (CCT) mechanism, including stages for knowledge preparation, visual and logical cue extraction, cross-validation, grounding, and report synthesis. Weighted multi-task reward optimizes the system via GRPO. The structured report can be used for downstream forensic applications.
Figure 3. The architecture of our PR² ( P erceiver, R easoner, R eviewer) pipeline. After an initial data collection stage, our multi-agent system generates annotations through a collaborative, iterative process. The Perceiver drafts an analysis, the Reasoner structures it to target CCT & analysis report, and the Reviewer validates its quality, initiating a refinement loop if necessary. This cycle, indicated by the solid and dashed feedback loops, ensures the final output is a high-fidelity, structured JSON annotation. Architecture diagram of the PR² (Perceiver, Reasoner, Reviewer) data curation pipeline. The figure shows the multi-agent system workflow: data collection stage, followed by collaborative annotation generation where the Perceiver drafts analysis, the Reasoner structures it for CCT and report, and the Reviewer validates quality with iterative refinement loops indicated by solid red and dashed purple arrows, producing structured JSON annotations.
| Dataset | Total | T-line | M-Lang | Det | Mask | Expl |
| T-IC13 ( Wang et al., 2022a ) | 462 | ✓ | ✗ | ✗ | ✗ | ✗ |
| T-SROIE ( Wang et al., 2022b ) | 986 | ✓ | ✗ | ✗ | ✗ | ✗ |
| OSFT ( Qu et al., 2024a ) | 2,938 | ✓ | ✗ | ✗ | ✗ | ✗ |
| DocTamper ( Qu et al., 2023 ) | 170,000 | ✗ | ✗ | ✗ | ✓ | ✗ |
| RealText-V1 (Ours) | 5,397 | ✓ | ✓ | ✓ | ✓ | ✓ |
Table 1. RealText-V1 is the first benchmark with comprehensive annotations for text-centric forgery analysis: textline-level annotations (T-line), multilingual support (M-Lang), detection (Det), grounding (Mask), and explanation (Expl).
| Method | RealText | T-IC13 | T-SROIE | ||||||||||||||||||
| Detection | Grounding | Explanation | M-F1 | Detection | Grounding | Explanation | M-F1 | Detection | Grounding | Explanation | M-F1 | ||||||||||
| Acc | F1 | mIOU | mF1 | CSS | BS(F1) | Acc | F1 | mIOU | mF1 | CSS | BS(F1) | Acc | F1 | mIOU | mF1 | CSS | BS(F1) | ||||
| Group 1: State-of-the-Art MLLM-based Frameworks | |||||||||||||||||||||
| FakeShield ( Xu et al., 2026 ) | 58.2 | 55.6 | 30.5 | 12.4 | 66.6 | 53.8 | 40.6 | 36.9 | 32.3 | 23.8 | 26.2 | 57.5 | 52.7 | 37.1 | 14.7 | 25.7 | 0.5 | 1.9 | 51.7 | 52.9 | 26.8 |
| TextSleuth-7B ( Qu et al., 2024b ) | - | - | - | - | - | - | - | 88.4 | - | - | - | - | - | - | - | - | - | - | - | - | - |
| Group 2: Powerful General-Purpose MLLMs | |||||||||||||||||||||
Table 2. Comprehensive performance comparison across three benchmarks: proposed RealText, T-IC13 ( zero-shot ) and T-SROIE ( dense text for robustness ), DocShield demonstrates superior performance, strong generalization and robustness. All metrics are in percentage (%). Acc: Accuracy, mIOU: mean Intersection over Union, CSS: Cosine Similarity Score, BS(F1): BERTScore F1. M-F1: the macro-average of its Detection F1, Grounding mF1, and Explanation BS(F1). Best results are in bold , second best are underlined , ’-’: Model unreleased and result not reported.
| Configuration | Detection | Grounding | Explanation | M-F1 | |||
| Acc | F1 | mIOU | mF1 | CSS | BS(F1) | ||
| DocShield (Full) | 91.4 | 93.2 | 32.4 | 36.7 | 85.0 | 76.9 | 68.9 |
| w/o GRPO (SFT only) | 89.4 | 90.3 | 27.6 | 31.1 | 81.9 | 73.2 | 64.9 |
| w/o CCT | 51.7 | 32.6 | 21.5 | 18.2 | 71.3 | 68.1 | 39.6 |
| w/o format reward | 91.2 | 92.6 | 32.1 | 36.0 | 83.8 | 75.4 | 68.0 |
| w/o grounding reward | 90.0 | 91.2 | 28.6 | 32.2 | 84.7 | 76.5 | 66.8 |
Table 3. Ablation study on the RealText-V1 Test set. Both the CCT mechanism and the weighted multi-task reward are shown to be critical for the performance of DocShield. All metrics are in percentage (%). Best results are in bold .
Figure 4. Qualitative comparison of artifact grounding and explanations across different methods. DocShield demonstrates superior performance, accurately identifying both visual artifacts and logical cues. Shaded regions indicate the localized tampered areas. Qualitative comparison figure showing artifact grounding and explanation results across different methods on example forged document images. DocShield results demonstrate superior performance in identifying visual artifacts and logical cues, with shaded regions indicating localized tampered areas compared to other MLLM baselines.
| Distortion | FakeShield | Gemini-2.5-Pro | DocShield | |||
| Det-F1 | M-F1 | Det-F1 | M-F1 | Det-F1 | M-F1 | |
| No Distortion | 55.6 | 40.6 | 83.2 | 53.9 | 93.2 | 68.9 |
| Blur ( =15) | 49.3 ( ) | 35.5 ( ) | 73.3 ( ) | 47.6 ( ) | 88.3 ( ) | 64.2 ( ) |
| JPEG ( =20) | 47.4 ( ) | 32.7 ( ) | 69.6 ( ) | 48.8 ( ) | 85.9 ( ) | 61.3 ( ) |
| Noise ( =0.3) | 46.2 ( ) | 31.9 ( ) | 61.2 ( ) | 36.2 ( ) | 84.7 ( ) | 61.1 ( ) |
| Rotate ( ) | 43.0 ( ) | 30.3 ( ) | 73.1 ( ) | 47.2 ( ) | 89.8 ( ) | 63.4 ( ) |
Table 4. Robustness Comparison under Extreme Perturbations. Det-F1 : Detection F1. M-F1 : Macro-average F1. Values in parentheses denote the performance drop relative to the No Distortion baseline. The most resilient method (smallest relative drop) for each metric is highlighted in red .
| Configuration | Detection | Grounding | Explanation | M-F1 | |||
| Acc | F1 | mIOU | mF1 | CSS | BS(F1) | ||
| DocShield (Full CCT) | 91.4 | 93.2 | 32.4 | 36.7 | 85.0 | 76.9 | 68.9 |
| FCLE (Full: Vis + Log) | 60.0 | 56.1 | 11.2 | 21.0 | 73.2 | 67.2 | 48.1 |
| FCLE (Logical Only) | 43.1 | 46.5 | 5.1 | 9.7 | - | - | - |
| FCLE (Visual Only) | 40.6 | 11.8 | 0.9 | 2.1 | - | - | - |
| w/o Visual Cues | 87.3 | 88.7 | 25.3 | 28.1 | - | - | - |
Table 5. Ablation results on RealText-V1. Comparisons include DocShield (“Reason First”), the FCLE baseline (“Classify First, Explain Later”), uni-modal variants, and CCT component ablations. M-F1 is macro-average F1. Best scores are in bold ; hyphens (-) indicate metrics not applicable.